Security Alert Summary
The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the handling of the black_email parameter. Authenticated users with administrator-level access (and above) can inject scripts that execute when an affected page is viewed. This issue specifically affects multisite installations and sites where unfiltered_html has been disabled.
CVE Details
- CVE ID: CVE-2026-0691
- Affected plugin / component: CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress
- Affected versions: All versions up to and including 1.6.2
- Published: January 17, 2026 at 7:16:01 AM UTC
- Last modified: January 17, 2026 at 7:16:01 AM UTC
- CVSS v3.1: Base Score 4.4 (MEDIUM) — Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated attacker with administrator-level privileges (CVSS Privileges Required: HIGH). No user interaction required (UI:N).
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and output escaping of the black_email parameter. The plugin stores attacker-controlled content that is later rendered in pages viewed by other users, allowing injected scripts to execute in those viewers’ browsers. The public records reference the plugin’s backend view file backend/views/settings/email_blacklist.phtml, which is associated with the handling of the email blacklist input.
This vulnerability only affects multisite installations and installations where unfiltered_html has been disabled, per the CVE description. Because the attacker must be authenticated with administrator-level privileges, the issue primarily enables script execution in the context of privileged pages rather than remote anonymous exploitation.
How This Could Impact Your Website
In a realistic scenario, a site owner or an administrator could be targeted by an authenticated attacker with admin-level access who adds a malicious entry via the email blacklist input. When other administrative users or staff access the injected settings page, the malicious script can run in their browsers. This can lead to limited confidentiality impacts (for example, exposure of user-related data accessible to that browser session) and integrity impacts (for example, the ability to modify content presented in the browser). Availability is not indicated as impacted by this vulnerability.
Practical consequences include exposure of internal user email addresses, increased risk of targeted phishing or social engineering against administrators and staff, and potential session-based attacks in the browsers of users who view the injected page. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and administrators.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your installation.
- Monitor site and user activity logs for unusual behavior, especially changes to plugin settings or additions to blacklist entries.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/cm-email-blacklist/tags/1.6.2/backend/views/settings/email_blacklist.phtml#L67
- https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/backend/views/settings/email_blacklist.phtml#L67
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3440158%40cm-email-blacklist&new=3440158%40cm-email-blacklist&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/821f4ea9-bc25-4d65-9058-5b77c4f1b230?source=cve
